3 ms·
In almost any context where banning E2E encryption would have useful law-enforcement results against unsophisticated criminals, there is always a legal way to i
by cornholio 3y ago
In almost any context where banning E2E encryption would have useful law-enforcement results against unsophisticated criminals, there is always a legal way to install a wire tap via an active attack. For example, a judge can force Signal to perform a MITM attack, and an unsophisticated target will simply ignore the key change warning. An alternate approach would be to use the auto-update features of the terminal and force the app distributors to sign and push a trojan to that specific target. You might have objections against such law enforcement techniques, but I think they have their place with proper judicial oversight.
Conversely, if the target is aware of such techniques, it's very, very unlikely they would use a channel they know is monitored.
So the trade-off here is: break the privacy of everyone, but allow law enforcement to do passive attacks without judicial overview. It's a no brainer that both things are bad and they do not improve our safety one bit. Who really finds such powers useful? Spooks and entrenched power structures, of course.
- hellojesus 3y ago> An alternate approach would be to use the auto-update features of the terminal and force the app distributors to sign and push a trojan to that specific target. This is a compelling reason to build from source for e2e messagers. Google's move to signing apks with their own keys helps facilitate the above.
- cornholio 3y agoRealistically speaking, defending against an active attack from your OS distributor targeting you specifically is an exceptionally tall order. It ultimately comes down to obtaining a known safe compiler, building something like a Gentoo stage 1 installation, then manually audit the source of each and every every security patch you apply, knowing that any minor update might actually hide some kind of remotely exploitable back door. You would need NSA-level of resources to pull this off, I doubt the apk signing by Google changes things significantly for Android users.
- hellojesus 3y agoTrue, but don't you think a massive amount of folks would devote time to an open source alternative just to stick it to govs if they tried to pass something like banning unlocked bootloaders? Grapheneos exists with a far smaller potential user base.